The software quietly storing millions of patients' X-rays, CT scans, and MRIs around the world has a vulnerability that could hand an attacker complete control of the server holding those records — and potentially the hospital network attached to it.
Who Is Affected — and Why It Matters
Orthanc is the open-source medical imaging server that hospitals, clinics, radiology labs, and telehealth platforms on every continent rely on to store and serve DICOM files — the universal format for medical images. It is not a niche product. Orthanc has been downloaded millions of times and powers imaging infrastructure at institutions ranging from small rural clinics to large academic medical centers. Because it often sits at the center of a hospital's diagnostic workflow, a compromised Orthanc instance is not merely a data breach waiting to happen — it is a potential foothold into the broader clinical network, where patient monitors, infusion pumps, and electronic health record systems all coexist.
The vulnerability is tracked as CVE-2026-5444 and carries a CVSS score of 7.1 (HIGH). No confirmed attacks have been recorded yet, but the nature of the flaw — and the sensitivity of the systems it affects — means the window between "disclosed" and "actively exploited" could be short.
What an Attacker Can Actually Do
Here is the scenario in plain English. A hospital radiologist receives a DICOM file — the standard package that wraps a medical image along with patient metadata. Those files come from scanners, from other hospitals, from referring physicians. Nobody manually inspects every pixel of every incoming file. Orthanc processes them automatically, the way your email client automatically previews an attachment.
An attacker who wants to exploit this vulnerability simply crafts a malicious DICOM file — one that looks legitimate on the outside but contains a specially constructed image embedded inside it. When Orthanc tries to read and process that image, something goes badly wrong in the math. The software calculates how much memory it needs to store the image, gets the answer catastrophically wrong, reserves a tiny slice of memory, and then proceeds to pour a much larger amount of data into that tiny space. That overflow spills into adjacent memory the program was using for something else entirely — and by carefully controlling exactly what gets written and where, a skilled attacker can redirect what the software does next. At that point, the attacker is running their own code on the hospital's server.
From there, the possibilities are grim. Patient records could be stolen or held for ransom. Images could be silently altered — a terrifying prospect in a diagnostic context. The server could be used as a launchpad to move deeper into the hospital network. In environments where Orthanc runs with elevated privileges, the blast radius grows even larger.
The Technical Detail That Makes This Dangerous
The root cause is a 32-bit integer overflow in the PAM image parsing component of Orthanc's DICOM processing pipeline. When the software calculates the required buffer size for pixel data, it multiplies image dimension values using 32-bit unsigned arithmetic. An attacker who supplies a crafted PAM image with specific dimension values can cause that multiplication to wrap around to a very small number — so the heap allocation succeeds and looks normal, but the subsequent pixel-write operation far exceeds the allocated region. This is a classic allocation undersize / write oversize heap buffer overflow, and it is precisely the class of bug that memory-corruption exploit techniques are built to leverage. Researchers tracking heap exploitation primitives will recognize this as a potentially high-reliability target depending on the allocator in use.
Discovered, Confirmed, Exploited?
As of publication, there is no confirmed evidence of active exploitation in the wild. The vulnerability was identified through security research into DICOM parser implementations — a category of software that has historically received far less scrutiny than its prevalence and sensitivity arguably warrant. Medical imaging parsers are complex, written to handle dozens of embedded image formats, and are often running in environments where "don't touch what's working" is the operational philosophy, meaning patch cycles can be long.
That combination — complex parsing code, sensitive targets, slow patch adoption — is exactly the profile that ransomware groups and state-sponsored actors have learned to look for. Healthcare was the most targeted sector for ransomware in 2024, according to multiple threat intelligence reports, and attacks that begin with a single vulnerable server have cascaded into full hospital shutdowns affecting patient care.
What You Should Do Right Now
Whether you are a hospital IT administrator, a security engineer responsible for clinical systems, or a developer who has embedded Orthanc into a telehealth product, here are three concrete steps to take immediately:
-
Update Orthanc to the latest patched release. Check the official Orthanc server repository at orthanc-server.com and the associated Hg repository for any release issued after the disclosure of CVE-2026-5444. If your current deployment is running a version prior to the patch, treat this as a critical update. Verify the version string in Orthanc's web explorer (default port 8042) by navigating to
/system— the"Version"field will tell you exactly what you are running. - Isolate your Orthanc instance from untrusted networks immediately. Orthanc should never be directly internet-facing, but audit your firewall rules today. Ensure that only authorized internal systems and known partner institutions can submit DICOM files. If you are using Orthanc's built-in HTTP API or DICOM listener (default port 4242), confirm those ports are not reachable from outside your clinical VLAN. Place a WAF or reverse proxy with strict request filtering in front of any externally accessible instance.
- Enable file-type validation and scan incoming DICOM files before ingestion. Configure your DICOM router or modality worklist to validate incoming files against expected sender sources. If your workflow allows it, implement a quarantine queue where incoming DICOM files are held and scanned before Orthanc processes them. Some enterprise DICOM gateways offer pre-processing hooks specifically for this purpose — enable them, and log every file that fails validation for follow-up investigation.
The good news is that no one has been hurt by this vulnerability yet — as far as anyone knows. The window to act before that changes is open. Medical imaging infrastructure has been a soft target for too long. This is a reminder that the files carrying the most intimate details of our health deserve the same security rigor as the financial systems carrying our money.